CVE-2021-35488

Thruk 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE] Reflected XSS via the host or title parameter

published November 9, 2021

CVSS
—
EPSS
3%
Percentile
85.6
In the wild
Unconfirmed
What it is

Thruk 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE] Reflected XSS via the host or title parameter. An attacker could inject arbitrary JavaScript into status.cgi. The payload would be triggered every time an authenticated user browses the page containing it.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02670 · 85.6th percentile
Published
2021-11-09T22:29Z
EPSS history
Timeline
  • 09 NOV 22:29Z
    Thruk 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE] Reflected XSS via the host or title parameter
    cvelistv5